1. Field of the Invention
The present invention relates to a method for controlling messages security protection in network system.
2. Background of the Invention
The data security in Internet is an important task. For the core protocol—Border Gateway Protocol (BGP) of Internet, to ensure the security of routes and BGP connections is a serious problem due to a large quantity of routes transferred among domains. In detail, any interception, tampering, or reinsertion to BGP messages should be prevented to protect BGP connections, therefore data messages in network is protected. According to BGP protocol, a conventional BGP data message comprises 16-byte of full “1” plus content of BGP the message. Thus if the TCP connection is intercepted, the content of BGP messages can be obtained easily as long as the full “1” domain is analyzed out, therefore not only security of data messages but also that of the whole network system can not be guaranteed. For example, an attacker may acquire route information according to BGP message, modify the route information and reinsert in the TCP data-sending stream. If error route information is reinserted in, the BGP error processing will interrupt the connection, which will result in route oscillation in the public network. If an error route is reinserted in, a route trap will occur, which will increase traffic on some and attack the router until the router halts or reset. Therefore, there is hidden trouble in security in conventional transmission mechanism of data messages based on BGP message.